轻松使用U盘,U盘病毒详细介绍

豆豆网   技术应用频道   2007年08月27日    社区交流

内容摘要:U盘病毒详细介绍

  结束安全软件相关进程,以及VMware tools

  SysWarn.exe

  snatry.exe

  sloemnit.exe

  SNATask.exe

  VMwareUser.exe

  snaregmn.exe

  vmsrvc.exe

  vmusrvc.exe

  FilMsg.exe

  Twister.exe

  gss.exe

  KAVStart.EXE

  KWatch.EXE

  清除方法:

  1.结束进程

  %Windows%CMD32.exe

  2.删除病毒文件

  %Windows%CMD32.exe

  %System%voice.cpl

  %System%timedate.cpl

  X:autorun.inf

  3.修改回系统时间

  4.重启计算机

  下载SREng

  打开sreng-系统修复-windows shell/ie-全选-修复-

  5.删除病毒创建的注册表

  [HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]
   "NOTEPAD"
   [HKCUSOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL]
   "CheckedValue"

  6.修改注册表,修复被禁用的“自动播放”

  [HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]

  "NoDriveTypeAutoRun"=dword:00000091

  7.删除 Image File Execution Options 映像劫持项

  [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsIceSword.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsTwister.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsSNATask.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsSysWarn.exe][HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionssloemnit.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsFilMsg.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsgss.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKAVStart.EXE]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKWatch.EXE]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRvaMon.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsrva.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMPMain.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMPMon.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMPSVC.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMPSVC1.exe]
   [HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMPSVC2.exe]

责编:豆豆技术应用

正在加载评论...